/**
 * olam memory install — Register `agentmemory` as an MCP server with the
 * operator's host claude.
 *
 * Shells to:
 *   claude mcp add agentmemory --scope <s>
 *     --env AGENTMEMORY_URL=http://localhost:3111
 *     --env AGENTMEMORY_SECRET=<from-file>
 *     -- npx -y @agentmemory/mcp
 *
 * The secret is read from ~/.olam/memory-secret (generated by A2 start or
 * A3 secret rotate). Missing secret → exit 1 with remedy.
 *
 * Rotation note: claude stores the env value at install-time. After
 * `olam memory secret rotate`, re-run `olam memory install` so claude
 * picks up the new value (the rotate command surfaces this as a warning).
 *
 * Security note (CP3 audit, 2026-05-13): the bearer secret transits as
 * an argv element of the spawned `claude` invocation. On Linux + macOS,
 * argv is briefly readable via `/proc/<pid>/cmdline` (Linux) or `ps -E`
 * (macOS) by any local user during the few ms claude runs. Blast radius:
 * operator's own machine (single-user dev laptop = effectively nil;
 * shared dev VM / interactive tmux = full secret disclosure to anyone
 * on the box). Same shape as every other `--env KEY=VAL` CLI. Operator
 * docs (A6) call this out + name the mitigation: don't run install on
 * boxes with untrusted local users. If/when `claude mcp add` grows a
 * `--env-stdin` form upstream, switch to it.
 *
 * Plan reference: docs/plans/olam-agent-memory-distributed/phase-a-tasks.md A4
 */
import type { Command } from 'commander';
import { type ClaudeShellDeps, type McpScope } from '../mcp/install-shared.js';
/**
 * Secret-reader seam. Defaults to `readMemorySecretOrNull` (which probes
 * `~/.olam/memory-secret`); tests inject `() => null` for the
 * secret-missing path so they don't depend on the host's real secret.
 */
export type SecretReader = () => string | null;
export declare const DEFAULT_SECRET_READER: SecretReader;
export interface InstallOpts {
    scope: McpScope;
    /**
     * Test-only override for the secret value. When set, bypasses the
     * `readSecret` seam entirely. Use `readSecret` instead for tests that
     * want to exercise the secret-missing path deterministically.
     */
    secret?: string;
    /** Test seam: override the secret-reader. Defaults to ~/.olam/memory-secret. */
    readSecret?: SecretReader;
}
export declare function buildClaudeMcpAddArgs(scope: McpScope, agentmemoryUrl: string, secret: string): {
    command: string;
    args: string[];
};
export declare function runInstall(opts: InstallOpts, deps?: ClaudeShellDeps): Promise<number>;
export declare function registerMemoryInstall(cmd: Command): void;
//# sourceMappingURL=install.d.ts.map